asyncrat | 48460a60bec86875ab2b5fd8b0275b326a9796cf65a58a13fbea854a5f6c83f2

Sharing

Copy URL Twitter E-mail

General

Target
48460a60bec86875ab2b5fd8b0275b326a9796cf65a58a13fbea854a5f6c83f2
Size 45KB
Sample260711-nqtkraht8p
SHA256 48460a60bec86875ab2b5fd8b0275b326a9796cf65a58a13fbea854a5f6c83f2
MD5 0e6c14b97afd5fb1bf676f259cc22526
SHA1 ac92d48f8686145907121f602181dc94ceb900e8
SHA512 cbeee1cfa9955df2fa4959cf8cfefe0a1b107daeb014c1b737e37e9c2b4bab6bb4ee07fe3eb6a9f0394b5affd9fd47a73fa00babc71b63b54697448692c6a048
SSDEEP 768:kuSOpTPTCFcWUeXa6mo2qA70ewUkA1MiZPI7zjbWgP3iDNot6CIFvHiRz1BDZMx:kuSOpTPOP2/wvDiW73bJPSDet6Dvi9dO
TLSH
T1DE232B003BE8812BF2BE4F7868F26245867AF5733603D5891CC451DB5A23FC69A436ED
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

s.damsex.blog:80
s.damsex.blog:22
s.damsex.blog:8080
s.damsex.blog:8880
s.damsex.blog:2052
s.damsex.blog:2082
s.damsex.blog:2086
s.damsex.blog:2095
s.damsex.blog:443
s.damsex.blog:2053
s.damsex.blog:2083
s.damsex.blog:2087
s.damsex.blog:2096
s.damsex.blog:8443
www.s.damsex.blog:80
www.s.damsex.blog:22
www.s.damsex.blog:8080
www.s.damsex.blog:8880
www.s.damsex.blog:2052
www.s.damsex.blog:2082
www.s.damsex.blog:2086
www.s.damsex.blog:2095
www.s.damsex.blog:443
www.s.damsex.blog:2053
www.s.damsex.blog:2083
www.s.damsex.blog:2087
www.s.damsex.blog:2096
www.s.damsex.blog:8443
blaster.s.damsex.blog:80
blaster.s.damsex.blog:22
blaster.s.damsex.blog:8080
blaster.s.damsex.blog:8880
blaster.s.damsex.blog:2052
blaster.s.damsex.blog:2082
blaster.s.damsex.blog:2086
blaster.s.damsex.blog:2095
blaster.s.damsex.blog:443
blaster.s.damsex.blog:2053
blaster.s.damsex.blog:2083
blaster.s.damsex.blog:2087
blaster.s.damsex.blog:2096
blaster.s.damsex.blog:8443
malware.s.damsex.blog:80
malware.s.damsex.blog:22
malware.s.damsex.blog:8080
malware.s.damsex.blog:8880
malware.s.damsex.blog:2052
malware.s.damsex.blog:2082
malware.s.damsex.blog:2086
malware.s.damsex.blog:2095
malware.s.damsex.blog:443
malware.s.damsex.blog:2053
malware.s.damsex.blog:2083
malware.s.damsex.blog:2087
malware.s.damsex.blog:2096
malware.s.damsex.blog:8443
nanocore.s.damsex.blog:80
nanocore.s.damsex.blog:22
nanocore.s.damsex.blog:8080
nanocore.s.damsex.blog:8880
nanocore.s.damsex.blog:2052
nanocore.s.damsex.blog:2082
nanocore.s.damsex.blog:2086
nanocore.s.damsex.blog:2095
nanocore.s.damsex.blog:443
nanocore.s.damsex.blog:2053
nanocore.s.damsex.blog:2083
nanocore.s.damsex.blog:2087
nanocore.s.damsex.blog:2096
nanocore.s.damsex.blog:8443
agenttesla.s.damsex.blog:80
agenttesla.s.damsex.blog:22
agenttesla.s.damsex.blog:8080
agenttesla.s.damsex.blog:8880
agenttesla.s.damsex.blog:2052
agenttesla.s.damsex.blog:2082
agenttesla.s.damsex.blog:2086
agenttesla.s.damsex.blog:2095
agenttesla.s.damsex.blog:443
agenttesla.s.damsex.blog:2053
agenttesla.s.damsex.blog:2083
agenttesla.s.damsex.blog:2087
agenttesla.s.damsex.blog:2096
agenttesla.s.damsex.blog:8443

Mutex

oDLMxeKRdGDm

Attributes

delay
0
install
true
install_file
0hwg.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  48460a60bec86875ab2b5fd8b0275b326a9796cf65a58a13fbea854a5f6c83f2
- Size 45KB
- SHA256 48460a60bec86875ab2b5fd8b0275b326a9796cf65a58a13fbea854a5f6c83f2
- MD5 0e6c14b97afd5fb1bf676f259cc22526
- SHA1 ac92d48f8686145907121f602181dc94ceb900e8
- SHA512 cbeee1cfa9955df2fa4959cf8cfefe0a1b107daeb014c1b737e37e9c2b4bab6bb4ee07fe3eb6a9f0394b5affd9fd47a73fa00babc71b63b54697448692c6a048
- SSDEEP 768:kuSOpTPTCFcWUeXa6mo2qA70ewUkA1MiZPI7zjbWgP3iDNot6CIFvHiRz1BDZMx:kuSOpTPOP2/wvDiW73bJPSDet6Dvi9dO
- TLSH
  T1DE232B003BE8812BF2BE4F7868F26245867AF5733603D5891CC451DB5A23FC69A436ED
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2